Comodo Firewall Pro 2.4

I unchecked "Do not show any alerts for the applications certified by Comodo" on my new XP sp2 Home install.

Does checking it increase my security risk?(I noticed the Comodo help file shows it unchecked.)

I prefer it unchecked. When unchecked I get alerts for three "applications":

alg.exe with services.exe as parent
svchost.exe with services.exe as parent
system with system as parent

alg and svchost are in C:\WINDOWS\system32\. System does not show a folder. What is its path?

As soon as I logon Comodo alerts:

application layer gateway service is trying to act as a server
application: alg.exe
remote ip:127.0.01port:listen(****) - TCP


generic host process for win32 services is trying to act as a server
application: svchost.exe
remote: ip:listen ports: ms-rpc(***) - TCP


windows system process is trying to act as a server
application: system
remote: ip:listen ports: ms-ds(***) - TCP


—
As soon as I connect to the Internet I get 2 additional alerts regarding svchost.exe(generic host process)

Generic host process for win32 services is trying to act as a server
application: svchost.exe
remote IP: **.**.***.*** port : nbdgram(***) - UD
Security considerations: c:\windows\explorer.exe has tried to use svchost.exe through OLE Automation, which can be used to hijack other applications. exploreer.exe might be using svchost.exe to connect to the Internet


Generic host process for win32 services is trying to connect to the Internet
application: svchost.exe(deny)
remote IP: 255.255.255.255 port: *****(**) - UDP


I have changed these settings a number of times and, it seems to me, that I have definitely been able to connect to the Internet fine even after denying all 3 svchost.exe requests. I believe that I have also denied the others with no obvious problems. I have "researched" what the "applications" are, but I still come away with uncertainty. The first of the two svchost.exe requests that I get after I connect to the Internet displays my own IP address(whois shows my ISP) as the remote IP; so, I assume this is some kind of "ping" or something. I have always denied these things in the past with ZA.

Which, if any, of these 3 applications do I need to be allowing through Comodo?

hi 072707

i have never used comodo firewall.

Do not show any alerts for the applications certified by Comodo

these must be apps that comodo recogonizes as legit window processes and if checked wont generate a popup– i assume thats it anyway. if checked then comodo must recognize them as core window components, hence no alert

svchost.exe can refer to several window processes. The popups can be confusing especially if you are behind a router or on a network, you are going about it the right way. nothing like actually experimenting– if you arent sure deny it access– remember what it is and make sure you still have a internet connection. go about it one by one making sure each time you can still get a connection. there are several window components that are enabled by default but dont need a connection, one is explorer. my previous firewall look n stop had a nice list of window components i denied access to. i would post a screen shot but iam now using norman firewall (i rotate my firewalls).It could also be different for you.

you might also look into turning off window core services. only do one or two at a time– if you do this remember which ones you changed so you can change them back if you lose any functionality:

http://www.beemerworld.com/tips/servicesxp.htm

http://www.blackviper.com/

you might poke around the comodo forum but i heard one must register just to browse it.

good luck if you stick with comodo.
There are also other good (free) firewalls out there other than comodo, you have used zone alarm in the past.
you might experiment and try one of these below, maybe you will find one you like better for whatever reason. all are free except for sunbelt/kerio which becomes a limited version after 30 days. some have learning curves. if you try one uninstall any other firewall first. i would say the most user friendly would be pc tools, then out post> look n stop> jetico. ive never used sunbelt/kerio. the old kerio was a excellent firewall.you can still find copies of it. some of these also have paid versions. The paid Out Post comes as a suite complete with malware scanner.


pc tools:
http://www.pctools.com/firewall/

sunbelt/kerio:

http://www.sunbelt-software.com/Home-Home-…sonal-Firewall/


out post free:
http://www.agnitum.com/products/outpostfree/download.php


look n stop lite
http://www.snapfiles.com/get/looknstop.html

jetico:
http://www.jetico.com/index.htm#/jpfirewall.htm"Do not show any alerts for the applications certified by Comodo"

i will be offline for the next several days if you post back.

shelf life